Splunk Search

If a field contains in an eval statement

jenkinsta
Path Finder

My data is like this illustration purposes only:

LocalIp aip
10.10.10.1192.168.1.1
10.10.10.2172.58.100.41

10.10.12.3
8.8.8.8
192.168.3.1

8.8.8.8

 

I am trying to search for any hits where LocalIP contains the aip address. In this example there is one hit

This is what I have but stuck at trying contains

| eval result=if(like(LocalIP, "%".aip."%"),"Match","")

 

 

Labels (1)
0 Karma
1 Solution

jenkinsta
Path Finder

This was the trick that worked 

eval result=if('LocalIP' == 'aip',"Match", "")

View solution in original post

0 Karma

jenkinsta
Path Finder

This was the trick that worked 

eval result=if('LocalIP' == 'aip',"Match", "")

0 Karma

richgalloway
SplunkTrust
SplunkTrust

How it that eval failing you?

Have you tried mvfind?

 

| eval result=if(mvfind(LocalIP, aip),"Match","")

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

jenkinsta
Path Finder

eval is not matching correctly. the mvfind says it has an error. 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please elaborate.

How is the eval not matching correctly?  What results do you get compared to what you expect?

What is the error reported by mvfind?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...